Security professional

One of the primary security features of Windows is the ability to control access to resources.  Every resource where access can be controlled is defined as a securable object.  According to Mr. Solomon “A securable object requires a Discretionary Access Control List (DACL) for Windows to control access to the object. Any object with no DACL defined is accessible by any subject (any process, any user).” (Solomon, 2011, p. 49)   An object’s DACL can be modified in the object’s properties dialog.

Access Control

(1) Overview of Access Control

· What is access control

· The ability to allow only authorized users, programs or processes system or resource access

· The granting or denying, according to a particular security model, of certain permissions to access a resource

· An entire set of procedures performed by hardware, software and administrators, to monitor access, identify users requesting access, record access attempts, and grant or deny access based on pre-established rules.

· Access control is the heart of security

· Access Control Models (based on how security policies are managed)

· Discretionary Access Control (DAC)

· Mandatory Access Control (MAC)

· Role-Based Access Control (RBAC): will discuss this later.

· DAC: Discretionary Access Control

· Definition: An individual user can set an access control mechanism to allow or deny access to an object.

· Relies on the object owner to control access.

· DAC is widely implemented in most operating systems, and we are quite familiar with it.

· Strength of DAC:

· Flexibility: a key reason why it is widely known and implemented in mainstream operating systems.

· Limitation of DAC:

· Global policy: DAC let users to decide the access control policies on their data, regardless of whether those policies are consistent with the global policies. Therefore, if there is a global policy, DAC has trouble to ensure consistency.

· Information flow: information can be copied from one object to another, so access to a copy is possible even if the owner of the original does not provide access to the original copy. This has been a major concern for military.

· Malicious software: DAC policies can be easily changed by owner, so a malicious program (e.g., a downloaded untrustworthy program) running by the owner can change DAC policies on behalf of the owner.

· Flawed software: Similarly to the previous item, flawed software can be “instructed” by attackers to change its DAC policies.

· MAC: Mandatory Access Control

· Definition: A system-wide policy decrees who is allowed to have access; individual user cannot alter that access.

· Relies on the system to control access.

· Examples:

· The law allows a court to access driving records without the owners' permission.

· Traditional MAC mechanisms have been tightly coupled to a few security models.

· Recently, systems supporting flexible security models start to appear (e.g., SELinux, Trusted Solaris, TrustedBSD, etc.)

(2) Access Control Methods

· Access Control Matrices

· Disadvantage:

· In a large system, the matrix will be enormous in size and mostly sparse.

· Access Control List

· The column of access control matrix.

· Advantage:

· Easy to determine who can access a given object.

· Easy to revoke all access to an object

· Disadvantage:

· Difficult to know the access right of a given subject.

· Difficult to revoke a user's right on all objects.

· Used by most mainstream operating systems.

· Capability List

· The row of access control matrix.

· A capability can be thought of as a pair (x, r) where x is the name of an object and r is a set of privileges or rights.

· Advantage:

· Easy to know the access right of a given subject.

· Easy to revoke a user’s access right on all objects.

· Disadvantage:

· Difficult to know who can access a given object.

· Difficult to revoke all access right to an object.

· A number of capability-based computer systems were developed, but have not proven to be commercially successful.

(3) Access Control List Examples

· UNIX ACL

· Abbreviations of Access Control Lists:

· Three classes: owner, group, other users

· Suffer from a loss of granularity

· Full Access Control Lists

· Abbreviations of ACLs are ignored when root is the subject, but the full-blown ACL apply even to root (In Solaris).

· Windows NT

· Generic rights: No access, Read, Change, Full control.

· Built-in Groups (each has different privileges)

· Everyone: all users

· Interactive: users logged on locally

· Network: users logged on over the network

· System: the operating system

· Creator / Owner: creator or owner of a file or a resource

· How is the ACL implemented in Minix?

· Where to store the access control list? (Must be in a safe place)

· ACL is saved in the I-node data structure in Minix (in i_mode).

· I-node data structure:

References

Galante V. Practical Role-Based Access Control. Information Security Journal: A Global Perspective [serial online]. March 2009;18(2):64-73. Available from: Academic Search Premier, Ipswich, MA. Accessed April 28, 2013.

Solomon, M. (2011). Security Strategies in Windows Platforms and Applications. Sudbury, MA: Jones & Bartlett Learning, LLC.